blustealer

General

Target
5d81fbfb555468e8dbcaf4eb11db5eb50a0bef70df7e8322a84fac5d6cb88977.exe
Size 125KB
Sample230306-rbh29aca9x
SHA256 5d81fbfb555468e8dbcaf4eb11db5eb50a0bef70df7e8322a84fac5d6cb88977
MD5 88eeeb298fabd21ef29c0b89d7aee4f9
SHA1 6ceb6efa6b16293c8ab278d9f4276ad9af1ca653
SHA512 0ac2637718ca22b7ee102360fd324761b24e13c991615f93c7f6f8ede72474a372f3f664fac5bd72d04d4977c388d401c3bcaf6d78e655e31eba2b6a4b4b1547
SSDEEP 1536:A/w/Zws3kTnvzbhNBPmxue2SRQg0dkEwiqoVioZkcOqJ40eZgYAv:A0ZTkLfhjFSiO3o3kcqZZG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5369570306:AAGakouymXOc8dp0WUuP_KaS81h9taRj_pk/sendMessage?chat_id=1884866272

Targets

- Target
  5d81fbfb555468e8dbcaf4eb11db5eb50a0bef70df7e8322a84fac5d6cb88977.exe
- Size 125KB
- SHA256 5d81fbfb555468e8dbcaf4eb11db5eb50a0bef70df7e8322a84fac5d6cb88977
- MD5 88eeeb298fabd21ef29c0b89d7aee4f9
- SHA1 6ceb6efa6b16293c8ab278d9f4276ad9af1ca653
- SHA512 0ac2637718ca22b7ee102360fd324761b24e13c991615f93c7f6f8ede72474a372f3f664fac5bd72d04d4977c388d401c3bcaf6d78e655e31eba2b6a4b4b1547
- SSDEEP 1536:A/w/Zws3kTnvzbhNBPmxue2SRQg0dkEwiqoVioZkcOqJ40eZgYAv:A0ZTkLfhjFSiO3o3kcqZZG
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

blustealer stormkitty collection stealer
- BluStealer
  A Modular information stealer written in Visual Basic.
  stealer blustealer
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

StormKitty

StormKitty payload

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2